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REMARKS 



The specification has been amended to reflect the application serial numbers assigned to the 
related applications. The claims have been amended to re-number claims 10-13 and to correct the 
dependency due to the misnumbering of claims. 

Attached is a marked-up version of the amendments showing the changes made. 

Applicant believes no fee is due for this Preliminary Amendment. However, the Director is 
authorized to charge any deficiency fees or credit any overpayments to Deposit Account No. 08-2025 of 
Hewlett-Packard Company. 



Date: 1^ 3^°^°^ 1» 

Munsch Hardt Kopf & Harr, P.C. 
1445 Ross Avenue, Ste. 4000 
Dallas, Texas 75202-2790 
Telephone: 214-855-7667 
Facsimile: 214-855-7584 



Respectfully submitted. 




Steven T. McDonald 
Reg. No. 45,999 
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MARKED-UP VERSION OF AMENDMENT SHOWING CHANGES 
IN THE SPECIFICATION 

CROSS-REFERENCE TO RELATED APPLICATIONS 

This patent application is related to co-pending U.S. Patent Application, Serial No. [ ] 

10/003.501 . entitled "METHOD AND COMPUTER READABLE MEDIUM FOR SUPPRESSING 
EXECUTION OF SIGNATURE FILE DIRECTIVES DURING A NETWORK EXPLOIT," filed 

October 31, 2001, co-assigned herewith; U.S. Patent Application, Serial No. [ ] 10/001.431 . 

entitled "SYSTEM AND METHOD OF DEFINING THE SECURITY CONDITION OF A COMPUTER 

SYSTEM," filed October 3 1, 2001, co-assigned herewith; U.S. Patent Application, Serial No. [ 1 

10/001.410 . entitled "SYSTEM AND METHOD OF DEFINING THE SECURITY VULNERABILITIES 
OF A COMPUTER SYSTEM," filed October 31, 2001, co-assigned herewith; U.S. Patent Application, 

Serial No. [ 1 10/002.695 . entitled "SYSTEM AND METHOD OF DEFINING 

UNAUTHORIZED INTRUSIONS ON A COMPUTER SYSTEM," filed October 31, 2001, co-assigned 

herewith; U.S. Patent Application, Serial No. [ 1 10/002.423 . entitled "NETWORK 

INTRUSION DETECTION SYSTEM AND METHOD," filed October 31, 2001, co-assigned herewith; 
U.S. Patent Application, Serial No. [ 1 10/003.815 . entitled "METHOD, COMPUTER- 
READABLE MEDIUM, AND NODE FOR DETECTING EXPLOITS BASED ON AN INBOUND 
SIGNATURE OF THE EXPLOIT AND AN OUTBOUND SIGNATURE IN RESPONSE THERETO," 

filed October 31, 2001, co-assigned herewith; U.S. Patent Application, Serial No. [ 1 10/001.446 . 

entitled "NETWORK, METHOD AND COMPUTER READABLE MEDIUM FOR DISTRIBUTED 
SECURITY UPDATES TO SELECT NODES ON A NETWORK," filed October 31, 2001, co-assigned 

herewith; U.S. Patent Application, Serial No. [ 1 10/003.747 . entitled "METHOD, COMPUTER 

READABLE MEDRJM, AND NODE FOR A THREE-LAYERED INTRUSION PREVENTION 
SYSTEM FOR DETECTING NETWORK EXPLOITS," filed October 31, 2001, co-assigned herewith; 

U.S. Patent Application, Serial No. [ 1 10/002.072 . entitled "SYSTEM AND METHOD OF 

AN OS-INTEGRATED INTRUSION DETECTION AND ANTI-VIRUS SYSTEM," filed October 31, 

200 1 , co-assigned herewith; U.S. Patent Application, Serial No. [ ] 10/002.697 . entitled 

"METHOD, NODE AND COMPUTER READABLE MEDIUM FOR IDENTIFYING DATA IN A 
NETWORK EXPLOIT," filed October 31, 2001, co-assigned herewith; U.S. Patent Application, Serial 

No. [ 1 10/003.820 . entitled "NODE, METHOD AND COMPUTER READABLE MEDIUM 

FOR OPTIMIZING PERFORMANCE OF SIGNATURE RULE MATCHING IN A NETWORK," filed 

October 3 1 , 200 1 , co-assigned herewith; U.S. Patent Application, Serial No. [ ] 10/003.819 . 

entitled "METHOD, NODE AND COMPUTER READABLE MEDRTM FOR PERFORMING 
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MULTIPLE SIGNATURE MATCHING IN AN INTRUSION PREVENTION SYSTEM," filed October 

31, 2001, co-assigned herewith; U.S. Patent Application, Serial No. [ 1 10/002,694 . entitled 

"USER INTERFACE FOR PRESENTING DATA FOR AN INTRUSION PROTECTION SYSTEM," 

filed October 31, 2001, co-assigned herewith; U.S. Patent Application, Serial No. [ 1 10/001.728 . 

entitled "NODE AND MOBILE DEVICE FOR A MOBILE TELECOMMUNICATIONS NETWORK 
PROVIDING INTRUSION DETECTION," filed October 31, 2001, co-assigned herewith; U.S. Patent 

Application, Serial No. [ 1 10/003.510 entitled "METHOD AND COMPUTER-READABLE 

MEDIUM FOR INTEGRATING A DECODE ENGINE WITH AN INTRUSION DETECTION 

SYSTEM," filed October 31, 2001, co-assigned herewith; U.S. Patent Application, Serial No. [ ] 

10/002.064 . entitled "SYSTEM AND METHOD OF GRAPHICALLY DISPLAYING DATA FOR AN 
INTRUSION PROTECTION SYSTEM," filed October 31, 2001, co-assigned herewith; and U.S. Patent 

Application, Serial No. [ 1 10/001.350 . entitled "SYSTEM AND METHOD OF GRAPHICALLY 

CORRELATING DATA FOR AN INTRUSION PROTECTION SYSTEM," filed October 31, 2001, co- 
assigned herewith. 

IN THE CLAIMS 

[10] 9. (Amended) The method according to claim 8, further comprising filtering, by the network 
filter service provider (140), all data received by the media access control driver (145) prior to passing of 
the data to the protocol driver (135). 

[11] 10. (Amended) The method according to claim 8, further comprising filtering, by the network 
filter service provider (140), all data received by the protocol driver (135) prior to passing of the data to 
the media access control driver (145). 

[12] JJ.. (Amended) A computer-readable medium having stored thereon a set of instructions to be 
executed, the set of instructions, when executed by a processor (272), cause the processor (272) to 
perform a computer method of: 

binding a network filter service provider (140) with a media access control driver (145) of a 
network stack (90 A) of an operating system (275); and 

binding the network filter service provider (140) with a protocol driver (135) of the network stack 
(90A) of the operating system (275). 
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[13] 12. (Amended) The computer readable medium according to claim [12] U wherein binding 
the network filter service provider (140) to the media access control driver (145) and to the protocol 
driver (135) occurs upon initialization of the operating system (275). 



